What is the maximum integer for maxOccurs in a XSD XML Schema?

Question

Is "2147483647" the maximum value that maxOccurs can handle? What is the maximum value that maxOccurs can handle? Setting a maxOccurs value to unbounded can lead to resources exhaustion and ultimately a denial of service

Here an example XSD with the maxOccurs set to what I think is the Maximum value that maxOccurs can handle please verify:

mySchema.xsd

<?xml version="1.0" encoding="UTF-8"?>
<xs:schema
xmlns:xs="http://www.w3.org/2001/XMLSchema">

<xs:element name="family">
    <xs:complexType>
        <xs:choice maxOccurs="unbounded">
            <xs:element name="person" maxOccurs="2147483647">
                <xs:complexType>
                    <xs:sequence>
                        <xs:element name="name" type="xs:string"/>
                        <xs:element name="firstname" type="xs:string"/>
                        <xs:element name="age" type="xs:int"/>
                    </xs:sequence>
                </xs:complexType>
            </xs:element>
            <xs:element name="address" type="xs:string" minOccurs="1"/> 
        </xs:choice>
    </xs:complexType>
</xs:element>

Why not just make it unbounded instead of an arbitrary large number? — rmlan, Dec 03 '13 at 14:52
possible duplicate of [W3C XML Schema and the maximum integer for maxOccurs](http://stackoverflow.com/questions/300196/w3c-xml-schema-and-the-maximum-integer-for-maxoccurs) — Klas Lindbäck, Dec 03 '13 at 14:55
Setting a maxOccurs value to unbounded can lead to resources exhaustion and ultimately a denial of service. I just want to know the maximum value I could use for this tag. @rmlan — javaPlease42, Dec 03 '13 at 14:58
Also 1 can lead to DoS problems. You can send a `person` with a `name` of 10^1000 characters, since [`xs:string` by default has no limit](https://stackoverflow.com/questions/966948/xsd-how-to-restrict-number-of-characters-in-string-type-attribute). Furthermore 2147483647 is an huge number, and can lead to DoS attacks as well. I think you must simply choice a reasonable max number of `person` that could be send, multiply by 10 and set that number. — Marco Sulla, Sep 12 '19 at 15:00

score 3 · Accepted Answer · edited May 23 '17 at 10:24

From the spec, the answer is: no limit. Below are snippets from the spec (links to XSD 1.0):

maxOccurs = (nonNegativeInteger | unbounded) : 1

For nonNegativeInteger, "The ·value space· of nonNegativeInteger is the infinite set {0,1,2,...}. "

Since no limit doesn't practically exists, each implementation sets its own...

Whether is "some Microsoft library" as someone was commenting earlier, or Java as it seems in your case, or an XML appliance, the limits may be clearly defined (as in Microsoft's case) or funky to understand, or managed externally through policies associated with your XML processor (most notably present in XML appliances).

For e.g., the maximum value that Xerces may return for a numeric maxOccurs is limited by what int means in Java, which is 2^31-1. If you put a 2^31 as maxOccurs in your XSD, some may say that Xerces will not behave appropriately... I believe it flips to unbounded...

I know for sure that setting high numbers to maxOccurs, in an attempt to prevent the DoS, may in fact have the opposite effect (have a look at this post)...

ok, so maybe _maxOccurs="1000"_ would be resonable and not lead to any performance problems. What do you think is the highest value that maxOccurs can be set to **without** causing any performance or stability issues. @Petru Gardea — javaPlease42, Dec 03 '13 at 20:45
@javaPlease42, my own practice is based on using a number that is firmly, or reasonably, driven by the domain I am targeting, or unbounded. I don't play in between; the deployments I am involved with rely on policies set at infrastructure levels; to give you an idea... have a look at [this](http://pic.dhe.ibm.com/infocenter/wsdatap/v3r8m1/index.jsp?topic=%2Fxi50%2Fwsproxy_settingparserlimits_task.htm). — Petru Gardea, Dec 03 '13 at 22:48

score 1 · Answer 2 · answered Dec 03 '13 at 18:50

As Petru Gardea has already noted, 2147483647 is not the highest legal value for maxOccurs for the simple reason that there is no highest legal value. The schema for schema documents in the XSD spec declares maxOccurs with a union type of xsd:nonNegativeInteger and the token 'unbounded', and xsd:nonNegativeInteger is ultimately a subtype of xsd:decimal. The rules on minimum implementation limits require that all implementations support all decimal values which can be written with sixteen significant decimal digits. So the largest value which is guaranteed to be accepted by all conforming XSD implementations is, I guess, 9999999999999999.

Specifying a numeric value for maxOccurs requires that the validator keep track of exactly how many elements it has seen, which makes for a larger finite state automaton (and is thus counterproductive if your goal is to limit resource usage).

A more reliable method of preventing resource exhaustion would be to run the validator in a process which has time limits and/or memory limits. Pretty much every operating system written in the last 50 years has the ability to impose such limits, and some XML parsers (such as rxp) have run-time options for the same purpose. Is there a reason you want to place your resource limits in the schema instead of using operating-system limits on the parsing process?

What is the maximum integer for maxOccurs in a XSD XML Schema?

2 Answers2